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-Abstract- 

We provide a general framework to remove short advice by formulating the following compu¬ 
tational task for a function /: given two oracles at least one of which is honest (i.e. correctly 
computes / on all inputs) as well as an input, the task is to compute / on the input with the 
help of the oracles by a probabilistic polynomial-time machine, which we shall call a selector. 
We characterize the languages for which short advice can be removed by the notion of selector: 
a paddable language has a selector if and only if short advice of a probabilistic machine that 
accepts the language can be removed under any relativized world. 

Previously, instance checkers have served as a useful tool to remove short advice of probabilis¬ 
tic computation. We indicate that existence of instance checkers is a property stronger than that 
of removing short advice: although no instance checker for EXP NP -complete languages exists 
unless EXP np = NEXP, we prove that there exists a selector for any EXP NP -complete language, 
by building on the proof of MIP = NEXP by Babai, Fortnow, and Lund (1991). 
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Introduction 


Blum and Kannan m introduced the notion of instance checker. Roughly speaking, an 
instance checker for a function / is an efficient probabilistic machine that, given access to an 
oracle, checks if the oracle computes f(x) correctly on a given instance x; the oracle models a 
possibly buggy program that purports to compute /, and an instance checker verifies whether 
the program works correctly on a given instance. 

The notion of instance checker is intimately related to interactive proof systems: the 
line of work showing the power of interactive proofs 123122 E] yielded instance checkers for 
P# p -, PSPACE-, and EXP-complete languages; in addition, Blum and Kannan m gave a 
characterization of the languages with an instance checker by a function-restricted interactive 
proof system. Since any language with an interactive proof protocol is in NEXP m , any 
language with an instance checker must be in NEXP fl coNEXP. 

In this paper, we investigate a computational task weaker than instance checking of a 
(Boolean) function /: we are given access to two oracles (instead of a single oracle) as well 
as an input x; again, both of the oracles purport to compute /; however, it is assumed that 
at least one of the two oracles is honest , i.e. computes f(q) correctly on all inputs q ; and 
the task is to compute f(x) with the help of the oracles in polynomial time. We shall call a 
probabilistic machine doing the task a (probabilistic) selector for /. 
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If the answers of oracles on the input x agree, then we have only to output the answer, 
which is surely correct by the assumption. Thus, the task of a selector is essentially to 
identify the honest oracle when two oracles disagree on x (i.e. one of the oracles asserts that 
/( x) = 0 , whereas the other asserts that f(x) = 1). 

Our main result shows that there exists a selector for EXP NP -complete languages. We 
also show that the notion of selector does not change even if there are one honest oracle 
and polynomially many dishonest oracles. Thus, these results can be encapsulated in the 
following phrase: “identifying an honest oracle among many is strictly weaker than instance 
checking unless EXP np = NEXP.” 

Although the task is weaker than instance checking, a situation in which one may assume 
existence of an honest oracle naturally arises out of computation with advice: Suppose, for 
example, that a (paddable) language L is computed by a probabilistic machine M with 
advice of one bit. We regard M with advice 0 and 1 as two oracles Aq and A\, respectively. 
By the definition of advice, either Aq or Ai is honest on all the inputs (of the same length). 
Thus, the advice of one bit can be removed if L has a selector. We can in fact remove advice 
of size O(logn), since a selector can identify an honest oracle among polynomially many 
oracles. 

1.1 Removing Short Advice for Probabilistic Computation 

In early work as to removing short advice for probabilistic computation, Trevisan and 
Vadhan 125 . gave an insight into the potential of instance checkability: they demonstrated 
that instance checkability can be exploited to remove short advice. Based on the existence 
of an instance checker for EXP-complete languages, they showed a quantitative tradeoff 
from a uniform worst-case-hardness assumption (i.e. EXP <2 BPTIME(t(n° ( - 1 ^))) to average- 
case hardness of EXP (i.e. EXP contains languages that cannot be solved by probabilistic 
computation on a fraction better than 5 + 7 of inputs in time t). 

They also argued that their result cannot be obtained via black-box uniform reductions. 
Typical constructions of a worst-case to average-case connection are based on the following 
scheme: we convert a function / into another function /', which is an error-correcting code 
of /; if we have a “black-box” algorithm that computes f on a fraction greater than | + e of 
the inputs, then a probabilistic machine that takes advice can compute / on all inputs by 
decoding f. Since it is impossible to uniquely decode /' for small e, the advice is used to 
identify / and is provably indispensable. 

Indeed, it was the instance checkability of EXP-complete languages that broke the black¬ 
box construction in the proof of Trevisan and Vadhan; the instance checkability enabled 
them to remove advice of logarithmic size. Therefore, it will be helpful for future research to 
closely understand the property that they actually exploited. 

Subsequent to their work, instance checkability has since been exploited to cope with 
short advice for probabilistic computation: for example, Barak [7] proved the first hier¬ 
archy theorem for probabilistic computation with short advice; Buhrman, Fortnow, and 
Santhanam m unconditionally separated BPEXP from BPP with advice of subpolynomial 
size; and Buhrman, Fortnow, Ivoucky, and Loff m gave some evidences that a deterministic 
efficient computation with oracle access to the set of Kolmogorov-random strings can be 
simulated by a probabilistic efficient computation. 

1.2 Our Results 

In fact, the notion of selector captures a property of removing short advice: 
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► Theorem 1.1. Let L be an arbitrary paddable language. The following are equivalent: 

1. There exists a selector for L. 

2. For any oracle R C {0,1}*, it holds that L £ BPP fl //log implies L £ BPP fi . 

That is, a paddable language has a selector if and only if short advice can be removed under 
any relativized world. (“//" means advice that can depend on coin flips of probabilistic 
machines as well as input length [25].) 

In addition, we construct a selector for EXP NP -complete languages, thereby indicating 
an essential difference between selectors and instance checkers. We also give an upper bound 
on the languages with a selector: 

► Theorem 1.2 (Main Theorem). 

1. Every EXP np -complete language has a selector. 

2. Any language with a selector is in S™ 13 (which is an exponential-time analogue of S%). 

Thus, existence of an instance checker is a property stronger than that of removing 
short advice (or, equivalently, existence of a selector): although no instance checker for 
EXP NP -complete languages exists unless EXP np = NEXP, short advice of a probabilistic 
machine that accepts EXP NP -complete languages can be removed. 

Our Techniques 

The most technical part of this paper is a proof of the main theorem (Theorem | 1 . 2 | Part |T|). 
In order to construct a selector for EXP NP -complete languages, we build on the proof of 
MIP = NEXP by Babai, Fortnow, and Lund [5]. As pointed out by Gabor Tardos in the 
paper p], the complexity of honest provers of the interactive proof system for NEXP-complete 
languages can be bounded above by EXP np . We crucially use this fact to check satisfiability 
of an exponential-sized formula with the help of an EXP NF -complete oracle. We also compare 
two exponential-sized strings by performing a binary search. 

Thanks to plenty of machinery that has been cultivated together with interactive proof 
systems, program checking, and PCPs, we can prove the main theorem by careful combinations 
of such machinery. For example, we exploit a multilinearity test [ 6 ] and the self-correction of 
low-degree polynomials mm- 

Due to the usage of arithmetization, we suspect that our proof of the main theorem does 
algebrize [T] but does not relativize. 


Variants of Selectors 

We also investigate other variants of selectors: a deterministic selector and a nonadaptive 
deterministic selector. We focus on the “suprema” of the languages with a selector, namely, 
upper bounds on these languages and existence of a selector for languages complete for a 
complexity class that is close to the upper bounds. (Note that the languages with a selector 
are not necessarily closed downward. For example, although NEXP C EXP np , we do not 
know whether NEXP-complete languages have a selector or not.) 

For a nonadaptive deterministic selector, we prove polynomial-time analogues of Theo¬ 
rem roi 


► Theorem 1.3. 

1. Every P -complete language has a nonadaptive deterministic selector. 

2. Any language with a nonadaptive deterministic selector is in S p . 
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The proofs of this theorem will clearly illustrate the basic ideas for Theorem |1.2| 

Notice that P NP is close to the upper bound S p since P NP CSjC ZPP NP (25[|TJ]. (Under 
suitable hardness assumptions, it holds that P NP = S p by derandomization [15].) 

For a deterministic selector, the supremum is PSPACE: 

► Theorem 1.4. 

1. Every PSPACE -complete language has a deterministic selector. More generally, any 
downward self-reducible language has a deterministic selector. 

2. Any language with a deterministic selector is in PSPACE. 

As with Theorem 0 a property of removing short advice for deterministic computation 
can be characterized by existence of a deterministic selector: 

► Theorem 1.5. Let L be an arbitrary paddable language. The following are equivalent: 

1. There exists a deterministic selector for L. 

2. For any oracle R C {0,1}*, it holds that L £ P R / log implies L £ P fl . 

1.3 Comparison with Prior Work 

In seminal work by Karp and Lipton m as to collapses of a uniform class contained in a 
nonuniform class, it was shown that NP C P/log implies NP C P and PSPACE C P/log 
implies PSPACE C P. These results are essentially equivalent to the existence of deterministic 
selectors for NP- and PSPACE-complete languages, respectively. 

Fortnow and Klivans [IB] observed that NEXP C BPP//log implies NEXP = BPP 
by combining previous results. Similarly, it is folklore that EXP np C BPP//log implies 
EXP np = BPP. This follows by combining the result by Buhrman and Homer m stating 
that EXP np C EXP/poly implies EXP np = EXP, the existence of an instance checker (or a 
selector) for EXP-complete languages, and BPP//log C P/poly (see [15]). 

We clarify the differences between the folklore and our results in two respects. First, 
our results can be relativized on the right-hand side. Second, selectors can be used to 
quantitatively remove advice of logarithmic size: if we allow a machine to run in time t 
(instead of polynomial time), then advice of size logf can be removed. 

► Corollary 1.6 (Analogous to Proposition 5.6 in [25]). There are an EXP NF -complete 
language L and a constant d £ N such that, for any nice time 6o?mc0 1: N —f N and any 
oracle R C {0,1}*, if L £ BPTIME fl (f(n))//logt(?r) then L £ BPTIME^(t(n d )). 

We mention in passing that, by substituting selectors for instance checkers in the proofs 
of Trevisan and Vadhan [25] , one can obtain a quantitative tradeoff from a uniform worst- 
case-hardness assumption on EXP np to a uniform average-case hardness of EXP np (see [251 
Theorem 5.7]). 

1.4 Application: Random Strings vs. Randomized Computation 

In Section [5] we will give another application in order to demonstrate usefulness of the notion 
of selector, by simply substituting selectors for instance checkers in the previous work by 
Buhrman, Fortnow, Koucky, and Loff m- 


i 


Although the definition of a nice time bound is the same as in [25], we note that the condition t{n ) < 2 
is not needed here. 
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They tried to show that a deterministic polynomial-time computation with oracle access 
to the set of Kolmogorov-random strings is, in some sense, equivalent to a probabilistic 
polynomial-time computation; they modeled oracle access to the set of Kolmogorov-random 
strings as advice strings of high nonuniform complexity. Although the nonuniform complexity 
of the advice strings is required to be much higher than that of Kolmogorov-random strings, 
they showed, as a partial result, that if a language L can be solved in deterministic polynomial 
time with high nonuniform advice, then L is in BPP with advice of almost linear size m 
Theorem 13]. 

Because the goal is to show that L is in BPP without any advice, they further observed 
that one can dispense with the advice of almost linear size if there exists an instance checker 
for L. From this observation, they showed that, for any class C £ {NP, P# p , PSPACE, EXP}, 
if some C-complete language can be solved in deterministic polynomial time with high 
nonuniform advice, then C C BPP m Theorem 15]. 

In fact, they proved this result by analyzing the two cases: For C £ {P# p , PSPACE, 
EXP}, they used an instance checker for C-complete languages, whose existence was shown 
by [221 EH E]; Unfortunately, because it is not known whether NP-complete languages have 
instance checkers or not, they needed to prove the result in another way solely for C = NP. 

The notion of selector, however, enables us to show the result in a unified way and to 
extend the result from {NP, P# p , PSPACE, EXP} to any classes whose complete languages 
have a selector. Given the fact that many languages have selectors ( e.g. languages with 
instance checkers and downward self-reducible languages), it becomes more plausible that 
we can dispense with the advice of almost linear size; thereby we slightly strengthen the 
connection between Kolmogorov-random strings and randomized computation. 


Organization 

In Section [2| we give formal definitions, common properties of selectors, and a proof of 
Theorem 0 Sections [3] [4] and [5] are devoted to investigating nonadaptive deterministic 
selectors, probabilistic selectors, and deterministic selectors, respectively. We mention some 
possible directions for future work in Section [7] 


Preliminaries and Notations 

We assume that the reader is familiar with basics of computational complexity (e.g. |2J). 

For a Turing machine M, let M(x) denote the output of M on input x £ {0,1}*. For 
an oracle Turing machine M and oracles Aq, A\ C {0,1}*, let M A °’ A i represent a machine 
equipped with access to oracle A C {0,1}* such that A(i ■ q) = Ai(q), for each i £ {0,1} and 
for any q £ {0,1}*. We identify false and true with 0 and 1, respectively. We also identify a 
language L C {0,1}* with its characteristic function from {0,1}* to {0,1}. For a Boolean 
formula p in n variables, we abuse notation and write p: { 0 ,1}" —> { 0 ,1}. 

We say that a language L is paddable if there exists a polynomial-time machine that, on 
input (x, l m ) where x £ {0,1}" and n < m, outputs a string y of length m such that y £ L 
if and only if £ £ L. 

2 Definitions and Common Properties of Selectors 

In this section, we give formal definitions of selectors and show common properties that all 
types of selectors have. First, we define a probabilistic selector: 
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► Definition 2.1 (Probabilistic Selector). A (probabilistic) selector S for a language L C {0,1}* 
is a probabilistic polynomial-time oracle Turing machine which computes L with high 
probability, given arbitrary two oracles A 0 , Ai C {0,1}* such that A 0 or A\ is equal to L. 
That is, for any input x £ {0,1}* and oracles Ao,A 1 C {0,1}*, 

L £ { A 0 , A ± } =► Pt[S a °’ A '(x) = L(x)\ >|, 

where the probability is taken over coin flips of S. 

Note that the success probability | in Definition 
often abbreviate a probabilistic selector as a selector. 

An oracle equal to L is said to be honest ; otherwise it is said to be dishonest. 

Next, we define a deterministic selector and a nonadaptive deterministic selector: 

► Definition 2.2 (Deterministic Selector). A deterministic selector for a language L is a 
deterministic polynomial-time oracle machine S such that S L ’ x (x) = S XL (x) = L(x) for 
any oracle X C {0,1}* and for any input x £ {0,1}*. 

► Definition 2.3 (Nonadaptive Deterministic Selector). A nonadaptive deterministic selector 
S for a language L is a deterministic polynomial-time oracle machine such that 

h S L ' X (x) = S x,L (x) = L(x) for any oracle X C {0,1}* and any input x £ {0,1}*, and 
S is nonadaptive, i.e. there exists a polynomial-time machine which, on input x £ {0, 1 }*, 
outputs the query set Q(x) of all the queries that S makes to either of the oracles. 

We state a useful structural property: 

► Proposition 2.4. The class of the languages with a selector is closed under polynomial-time 
Turing equivalence. Namely, L\ <ffp L 2 and L 2 L\ imply that if L± has a selector then so 
does L 2 - 

In particular, it is closed under complement. Moreover, for any complexity class C, if a 
specific C-complete language has a selector, then so does an arbitrary C-complete language. 

Proof. The proof is essentially the same with Beigel’s theorem EH. which shows the same 
closure property of instance checkers. The idea is as follows: reduce a L 2 problem to a L\ 
problem by using the reducibility from L 2 to L\ , and solve the L± problem by running a 
selector for L\, while converting its query (which is an instance of L{) into an instance of L 2 . 

Let Mij be a polynomial-time oracle machine that witnesses the polynomial-time Turing 
reduction Lj Lj for each (i,j) £ { (1, 2 ), ( 2 ,1) } (that is, M^ 3 (x) = Li(x) for any x), and 
S' be a selector for L\. The following algorithm yields a selector for L 2 : Given an input 
x £ {0, l} n and two oracles A$,A\, simulate M 2 i(x) in order to compute L 2 {x). If M 2 1 
makes a query q , then we try to answer it with L\(q), by running S(q). If S makes a query 
q' to the ith oracle (i £ {0,1} ), then answer it with M A f(q'). 

Let Aj be an honest oracle (i.e. A, = L 2 ). Then, we have M A f(q') = M()f(q') = Li(q'), 
and hence S(q) is simulated under the existence of the honest oracle; thus it outputs L\(q) 
correctly with high probability (say, with probability at least 1 — 2 -n , by running the selector 
0(n) times). Therefore, the simulation of M 2 \(x) results in outputting L 2 (x ) with probability 
at least 1 — 2 ~ n n°^\ ◄ 

► Remark 2.5. Similarly, the class of languages with a deterministic selector is closed under 
polynomial-time Turing equivalence, and the class of languages with a nonadaptive deter¬ 
ministic selector is closed under polynomial-time truth-table (i.e. nonadaptive) equivalence. 


2.1 


can be enhanced by repetitions. We 
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To prove Theorem o we show that the definitions of selectors are robust even if we 
consider a situation in which we are given polynomially many oracles. 

► Lemma 2.6. For any language L C {0,1}*, the following are equivalent: 

1. There exists a selector for L. 

2. There exists a selector for L that identifies an honest oracle among polynomially many 
oracles. 

The latter can be formally stated as follows: for any polynomial m: N — > N, there exists 
a probabilistic polynomial-time oracle Turing machine S such that, on input length n £ N, it 
holds that Pr [ 5 ^( 2 ) = L(x)] > | for any x £ {0,1}", where A is an arbitrary oracle such 
that there exists an index i £ {1, • • • , m(n)} that satisfies A(i, q ) = L(q) for all q £ {0,1}*. 

Proof. The one direction is obvious: If there exists a selector that works among m(n) oracles, 
then letting ro(n) := 2 yields a selector that works among two oracles. 

Conversely, let S be a selector (that identifies an honest oracle among two oracles) with 
probability at least 1 — 3m * . Given an oracle A, let Ai(q) denote A(i, q) for any i £ N. On 
input x £ {0,1}”, we first make a query x to all the oracles A\, ■ ■ ■ , A m t n \, and divide them 
into the two sets according to their answers: 


Co = {j £ {1,- •• , m(n)} \ Aj(x) = 0}, 
Ci = {k £ {!,■•■ ,m(n)} \ A k (x) = 1}. 


That is, C a (a £ {0,1} ) is the set of the indices of all the oracles asserting that L(x) = a. 

Next, we repeat the following until Co = 0 or Ci = 0: Pick arbitrary elements j £ Co 
and fc £ Ci. We check which is a supposedly honest oracle by running S Aj ’ Ak on input x. 
If S Ai,Ak {x) = 0, then we doubt A k and thus eliminate k from Ci; Otherwise we doubt Aj 
and eliminate j from Co- 

Finally, we output 1 if and only if Ci 7 ^ 0. 

Now let us analyze this algorithm. It runs in polynomial time because |C'o| + |Ci| is 
decreased by one in each repetition. 

We claim the correctness of the algorithm. For simplicity, we assume that L(x) = 0. 
Then, there exists an index i £ {1, • • ■ , m(n)} such that A,; is honest and * £ Co- If i £ Co 
and some k £ Ci are picked in a repetition, then Pr [S' j4i, " 4fc ( 2 ) = 0] > 1 — 3m * . That is, i 

remains in Co with probability at least 1 — . Since i is picked at most |Ci| (< m(n )) 

times, the probability that i remains in Co is at least 1 — m{n) ■ 3m * n ^ = |. ◄ 


► Remark 2.7. Although Lemma 2.6 is stated only for a probabilistic selector, analogous 
statements hold for a deterministic selector and a nonadaptive deterministic selector. For a 
deterministic selector, one can easily check that the same proof works. For a nonadaptive 
deterministic selector, we must compute the query set in polynomial time. On input 
2 , let Q(x) denote the query (to either A 0 or A\) set of a selector that identifies an 
honest oracle among two oracles. Then we can define all the set of possible queries as 
< 5 '( 2 ) := { (i, q) £ N x {0,1}* | 1 < i < m(\x\), q £ Q(x) U { 2 } }, which is clearly computable 
in polynomial time. 


By using Lemma |2.6| we characterize the class of the paddable languages with a selector 
by the property that short advice can be removed under any relativized world. In fact, we 
can prove a statement stronger than Theorem |1.1| 


► Theorem 2.8. 
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1. For any paddable language L, if L has a selector, then L £ BPP fl //log implies L £ BPP^ 
for any oracle R C {0,1}*. 

2. For any language L, if L £ P R /1 implies L £ BPP R for any oracle R C {0,1}*, then L 
has a selector. 

As a corollary, we immediately obtain Theorem 1.1 (note that P R /1 C BPP^/yiog). 


Proof. 


Part 0 Let M be a polynomial-time oracle machine which witnesses L £ BPP fl //a, where 
a(n) = O(logn). That is, there exists an advice function a: {0,1}* —► {0,1}* such that, for 
every n £ N, 


Pr 

rG{0,l}*( n ) 


[Vze{o,ir, 


M R (x,r,a(r)) = L(x)] > 


5 

6 ’ 


(1) 


where |a(r)| = a(n) and t is a polynomial (see also [25; Definition 5.1]). 

Let l(n) (= n°^ ) be an upper bound on the running time of a selector for L on inputs 
of length n. By Lemma |2.6[ there exists a selector S that can identify an honest oracle 
among m(n) oracles for m(n ) := 2“^™^ = n ° ( - 1 ^ with probability at least By padding, we 
may assume that S makes only queries of length exactly l(n) on each input length n £ N 
Consider the following probabilistic algorithm: On input x £ {0, l} ra , pick a string 
r £r {0, ljddO)) uniformly at random, and define oracles by Ai(q) := M R (q,r,i ) for any 
q £ { 0 , l}*( n ), where i £ { 1 , • • • ,m(n)} is identified with i £ { 0 , 1 }“ (z(n))_ Simulate S on 
input x , answering its queries q £ { 0 , 1 }^”) to Ai by computing M R (q,r,i). 

If a “good” string r is picked (whose probability is at least | by 0 ) , then we have 
Ai(q) = M R (q,r,i ) = L(q) for any q £ {0,1}^"\ where i = a(r). That is, Ai is honest for 
some i with probability at least |. Thus, the algorithm computes L correctly with probability 
at least 1 — } — } = 

6 6 3 


Part |2j We prove the contraposition. Assume that L does not have any selectors. 

Recall that we regard the computation given oracle access to two oracles Rq,Ri, namely 
M Ro,Ri , as M R where R{i ■ q) = Ri{q) for each i £ {0,1}. Thus, the goal is to show that 
there exist oracles Rq, R\ C {0,1}* such that L £ p R oFi j\ an d £ ^ gppflo.fli 

We use a diagonalization argument on all the probabilistic polynomial-time oracle machine 
Mi, M 2 , • • •. We construct Rq £ \r^ at stage e £ N, and then define Ri := (J e f?- c> for each 

i e {0,1}. 

We will construct them so that, for each n £ N, there exists j n £ {0,1} such that 
Rj n {q) = L(q) for any q £ {0,1}”. Thus, L £ p R o. R i/\ holds because we can make a query 
x to obtain Rj n {x) = L(x) with advice {j n }neN of one bit. 

Let us now construct R^\ R^\ and l^ £ Z, where l^ represents the maximum length 
of the strings that have been fixed. At stage e = 0, we set R q 0 " 1 = R^ = 0, and Z *- 0 - 1 := —1. 

At stage e > 1, we claim that f?g e 11 and r[ l 11 can be extended so that some input x^ 
can fool M e : 

► Claim 2.9. For each e > 1, there exist oracles Aq,Ai C {0,1}* and a string x^ £ {0,1}* 
such that 

1. A, agrees with R^f on all the strings of length at most for each i £ {0,1}, 

2. either Ao or A\ agrees with L on all the strings of length greater than l and 

3. Pr [MA>Ai( 2 ;(D) = L{x^)] < |. 
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Proof of Claim 12.91 Assume otherwise. That is, for any oracles Aq, A\ C {0,1}* and string 
x £ {0,1}*, we have Pr [M A °’ Al (x) = L(x)\ > | if Properties 0 and jsj hold. Then, the 
following algorithm yields a selector for L, which contradicts the assumption: we hardwire 
all the strings in R[ e 11 of length at most into a table; given oracles Aq,A± one of 

which agrees with L , we simulate M e , answering its queries q to Ai ( i £ {0,1}) with the 
content of the table if |g| < and with Afiq) otherwise. ◄ 


Define l^ ) as an upper bound on the length of the queries that M A °’ A i (a;( e )) 

makes. Then, define R as R^ e \q) := r\ l 1 ) (g) = Afiq) if |q| < R.[ c \q) := Ai(q) 

if < |g| < l^- and R[ e \q) = 0 otherwise, for each q £ {0,1}*. This completes the 

construction of stage e. 

On one hand, x^ witnesses not computing L on input x^ for any e > 1, by 

Property [ 3 ] thus, we have L qL BPP^ 0 ’^ 1 . On the other hand, for each input length n £ N, 
either Rq or R\ agrees with L on {0,1}”, by Property [ 2 ] thus, we have L £ -4 


► Remark 2.10. Again, the analogous statement (Theorem |1.5[ ) holds for a deterministic 
selector. A proof is essentially the same and hence is omitted. 

One can also prove the quantitative version (Corollary 1.6 1 of Part [l] of Theorem 2.8 by 
changing parameters in the proofs of Theorem |2.8| and Lemma |2.6[ 


Nonadaptive Deterministic Selector 


In this section we prove Theorem |1. 3 1 

We first prove Part [l] of Theorem L3 which states that every P NP -complete language 
has a nonadaptive deterministic selector. It is sufficient to show that a specific P NP -complete 
language has a selector (recall Proposition 2.4 and Remark 2.5 I. We construct a nonadaptive 
deterministic selector for the following canonical P NP -complete language (see m for a proof 
of its completeness). 


► Definition 3.1 (Lexicographically Maximum Satisfying Assignment; Krentel |20j). The lexi¬ 
cographically maximum satisfying assignment problem contains all the pairs {p, k) such that 
p: {0,1}” — > {0,1} is a satisfiable Boolean formula in n variables for some n £ N, and a*, = 1, 
where a± ■ ■ ■ a n £ { 0 , 1 }" denotes the lexicographically maximum satisfying assignment of ip. 


In other words, the lexicographically maximum satisfying assignment problem is the 
decision version of the problem of answering, given a Boolean formula ip in n variables, the 
lexicographically maximum satisfying assignment if ip is satisfiable and 0" otherwise. Note 
that it is implicit in the definition that the answer is 0" for an unsatisfiable Boolean formula. 


Proof of Part [1] of Theorem 11.31 We show an algorithm of a selector for the lexicographi¬ 
cally maximum satisfying problem, together with its analysis. Let us call two oracles Aq and 

A\. 

On input (ip, k ), the set of all the queries that we make is { (<p, j) \ j £ {1, • • • , rz} }, 
where n £ N is the number of variables in ip. The (presumably) lexicographically maximum 
satisfying assignment asserted by each oracle A,; (* £ { 0 , 1 }) can be obtained by concatenating 
the answers of the oracle, namely Afip, 1 ) • Ai(<p, 2 ) • • • Ai(tp, n) =: Vi £ {0, l} n . 

If the kth bits of vq and v\ agree, then we simply output it because the oracles agree on 
input (p,k). 

Otherwise Vq is not equal to v\. Therefore, we may assume without loss of generality 
that vq < v\. We check whether v\ is a satisfying assignment or not by evaluating p{v\). If 
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<fi(v 1 ) = 1, then we trust the oracle A\ and output Ai{ip, k) because Ai showed a satisfying 
assignment larger than vq; otherwise we doubt A\ and output Ao(ip,k) because Ai tried to 
cheat us by answering an unsatisfying assignment. ◄ 

Then we show that any language with a nonadaptive deterministic selector is in S^- 

Proof of Part [2] of Theorem 11.31 Let L be a language with a nonadaptive deterministic 
selector S. We claim that L is in SEJ. Let Q(x) = {q \, • • ■ , q rn } be the query set of S on 
input x £ {0,1}*. 

We consider the following polynomial-time machine M: Suppose that the input to M is 
(x, y, z) £ {0,1}" x {0, l} m x {0, l} m . Let y = yi ■ ■ ■ y m and z = z\ ■ ■ ■ z m . M simulates the 
selector S on input a;. If S' makes a query g,; to the oracle Aq, then it is answered with y-i. 
Similarly, if S makes a query qi to the oracle Ai, then it is answered with Z; L . 

Then, there exists y £ {0, l} m such that M(x,y,z) = L(x) for any z £ {0, l} m . Indeed, 
if y is the concatenation of ,L(q m ), then by the definition of a nonadaptive 

deterministic selector, M(x,y,z) correctly outputs L(x) for any z £ {0, l} m , because all the 
queries that S makes to Ag are answered correctly. Similarly, there exists z £ {0, l} m such 
that M(x, y, z) = L(x) for any y £ {0, l} m . ◄ 

4 Probabilistic Selector 

In this section we investigate probabilistic selectors. 

First, we show that probabilistic selectors can be constructed based on instance checkers. 
An instance checker is formally defined as follows: 

► Definition 4.1 (Instance Checker m)- An instance checker C for a language I is a 
probabilistic polynomial-time oracle machine such that, given any oracle A C {0,1}*, 

1. if A = L then C A accepts with high probability, i.e. Pr [C A (x) = 1 ]> | on all the input 
x £ {0,1}*, and 

2. for any input x £ {0,1}*, if A(x) ^ L{x) then C A (x ) rejects with high probability, i.e. 
Pr [C A (x) = 0] > §, 

where the probability is taken over coin flips of C. 

► Proposition 4.2. Every language with an instance checker has a selector. 

Proof. Suppose that a language L has an instance checker C. Given input x £ {0,1}* and 
two oracles Ao,A± C {0,1}*, we check which is honest, A n or A\, by computing C A °(x). If 
C A °{x) accepts, then we trust A 0 and output Ao(x); otherwise we doubt A 0 and output 
Ai(x). 

Let us analyze the algorithm above. If Aq = L, then C A °(x ) accepts with probability at 
least |, and hence we can output Aq(x) = L(x) correctly with probability at least |. 

Otherwise, it must hold that A\ = L. If A 0 (x) = L(x), then we can surely output L(x) 
correctly since A 0 (.t) = A\(x) = L(x). If A 0 (x) ^ L(x), then C A °(x ) rejects with probability 
at least |, and thus we can output A\(x) = L(x) correctly with probability at least |. ◄ 

Next, we show an upper bound on the languages with a probabilistic selector. For 
completeness, we include a definition of S™ 13 , which is a straightforward exponential-time 
analogue of : 


S. Hirahara 


11 


► Definition 4.3. We say that a language L is in S^ 1 ’ if there exist a time-constructible 
function t(n) = 2"° ( 1 and a Turing machine M running in time 2^ 1 ' on input ( x , •) such 

that, for any input x £ { 0 , 1 }*, 

3y £ { 0 , 1 }^D ,Mz £ { 0 , 1 }^'), M{x,y,z) = L(x), 

3z £ {0, l} t(|x|) , \/y £ {0, l} t(N) , M(x, y, z) = L(x). 

The proof itself is essentially a corollary of Part [2] of Theorem |1.3| 

Proof of Part [2] of Theorem 11.21 Notice that a probabilistic selector can be simulated by 
an exponential-time nonadaptive deterministic selector. In addition, every language with an 
exponential-time nonadaptive deterministic selector is in S™ 13 , which is an exponential-time 
analogue of Part [2] of Theorem |1.3| Combining these two facts, it follows that every language 
with a probabilistic selector is in S^. ◄ 

4.1 Selector for EXP NP -complete Languages 

In this subsection we prove the main theorem (Theorem |1.2[ Part [I]). That is, we construct 
a selector for EXP NP -complete languages. 


Proof Sketch 


We sketch the proof of the main theorem. We will construct a selector for a specific 
EXP NP -complete language, which is a problem of finding the lexicographically maximum 
satisfying assignment of a succinctly described Boolean formula F$: {0, l} 2 " —>• {0,1}. The 
basic strategy to construct a selector for this language is the same with that of Part [l] of 
Theorem 1.3 Given access to two oracles A 0l A\ C {0,1}*, we request them to reveal the 
presumably lexicographically maximum satisfying assignments Vo, V) £ {0, l } 2 asserted by 
Aq,A±, respectively. The rest of the algorithm consists of two parts: First, we determine 
the larger assignment of Vo and V), checking whether Vo < V\ or Vo > V). Second, we verify 
whether the larger assignment satisfies the formula or not. Obviously, the obstacle is that 
there can be exponentially many variables and clauses in 

For the second part, Babai, Fortnow, and Lund [B] showed that, given access to provers 
(or, equivalently, an oracle), one can efficiently check that exponentially many constraints in 
F$, are satisfied: basically, by encoding an assignment as a multilinear function and using 
aritlrmetization, it holds that the assignment satisfies all the clauses in if and only if the 
sum of some low-degree polynomials (that can be computed by the multilinear function and 
the aritlrmetization) over a subdomain { 0 , l} , is equal to 0 , and the latter can be verified by 
using the sum-check protocol [H] (called the LFKN protocol in [B]). As pointed out by Gabor 
Tardos .B], since EXP np is capable of finding a satisfying assignment of an exponential-sized 
Boolean formula, the honest oracle in the protocol above can be implemented in EXP np ; 
thus, given access to an honest EXP NP -complete oracle (which is Aq or Ai), one can verify 
the satisfiability. 

For the first part, we perform a binary search to obtain the lexicographically first index 2 
such that Vo and V) disagree. Thus, we need 

1. to check if Vo = V\ on some range of indices, and 

2 . to split the range into two parts. 

We observe that these can be done if we encode a satisfying assignment by the multilinear 
extension (as with my Let F be a finite field. We regard the assignments Vo, V\ £ {0, l} 2 " 
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as vectors in F 2 ". There is a bijective correspondence between a vector V £ F 2 " and a 
multilinear function V: F” —> F. For example, if n = 2 and V = (Voo, Voi, Plo, Vu), then 

V(xi,X 2 ) = Voo(l — Xi)(l — X 2 ) + Voi(l — xf)X 2 + Vl0*l(l ~ X 2 ) + V\\X\X 2 . 

For Part [T] we can rely on the polynomial identity testing: indeed, since the multilinear 
extension is bijective, we have Vo 7 ^ V\ if and only if these multilinear extensions Vq and V\ 
differ; thus, it is sufficient to check if the two low-degree polynomials Vo and V\ differ. 

It is well known that, given access to two low-degree polynomials, one can efficiently 
check if these polynomials differ: given access to two functions Vo, V\, pick a random point 
u Sfl F” and check if Vq(u) 7 ^ V\ (u). Assuming that the functions are low-degree (which is 
true if they are multilinear), the Schwartz-Zippel lemma assures that Vo and V\ disagree on 
a large fraction of inputs if Vo 7 ^ Vj. Although it is possible that a dishonest oracle tries 
to cheat us by storing a high-degree polynomial, we can check whether or not the function 
stored by an oracle is close to some multilinear function, by using the multilinearity test (B]. 

For Part [2j we use the following simple fact: Fixing the first variable of a multilinear 
extension V to 0 or 1, we obtain multilinear extensions that correspond to the first or second 
part of V. In the example above, we obtain two multilinear functions: 

V(0,x 2 ) = Vbo(l - x 2 ) + V 0 \x 2 , V(l,x 2 ) = Vio(l - x 2 ) + V n x 2 . 

These correspond to multilinear extensions of (Voo, V 01 ) and (Vio, V 11 ), respectively, for n = 1. 
Thus, we can recursively compute the lexicographically first disagreement. 

Proof of the Main Theorem 

Now we move on to the proof of the main theorem. We construct a selector for the following 
EXP NP -complete language, which is an analogue of the NEXP-complete languages called 
the oracle-3-satisfiability problem in jB]. 

► Definition 4.4 (Lexicographically Maximum Oracle-3-satisfying Assignment). Let m,n be 

nonnegative integers, and 4>: {0, i } m + 3n + 3 { 0 , 1 } be a Boolean formula. For a Boolean 

function X : {0,1}™ —> {0,1}, define _F$(X) as the following Boolean formula: 

A $K^(M,A-(y,i(y), 

tpG{ 0 ,l} Tn “ l " 3Tl 

where w = (y, (61 , £> 2 , ^ 3 )) G {0, l} m x ({0, l}") 3 . A Boolean function X: {0, l} ra —> {0,1} 
is said to be an assignment of F$. For assignments X,Y: {0,1}" —> {0,1}, we introduce 
the lexicographical ordering: X is less than V if there exists an index b £ {0,1}” such 
that X(b) < Y(b) and X(b') = Y{b') for any b' < b. Let V$: {0,1}” —► {0,1} denote the 
lexicographically maximum assignment such that F$(V$) = 1 (i.e. the lexicographically 
maximum satisfying assignment of F$); if there is no satisfying assignment, then define 
Vjj(b) = 0 for any b £ { 0 , l} n . 

The lexicographically maximum oracle-3-satisfying assignment is a problem of answering 
V*( 6 in), given nonnegative integers m,n , a Boolean formula 4>: | 0 j l } m+3ll + 3 —> {0,1}, and 
an index b ln £ { 0 , 1 }" as input. 

We omit a proof of EXP NP -completeness because this is a simple exponential-time analogue 
of the lexicographically maximum satisfying assignment language [2D] (see also [B]). 

Suppose that the input is a Boolean formula $: {0, l } m + 3n + 3 { 0 , 1 } and an index & in , 

and that we have access to two oracles Aq and Ai, one of which is honest. 
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Encoding Assignments by the Multilinear Extension 

As with the proof of MIP = NEXP [B], we encode a satisfying assignment by the multilinear 
extension. Let F be a prime field such that |F| is sufficiently large (but is bounded by a 
polynomial in the input size). We regard {0,1} C F in the canonical way. We say that a 
function /: F” —> F is multilinear if it is a polynomial of degree at most 1 in each variable. 

► Proposition 4.5 (Multilinear Extension). Let f: {0,l} n —>■ F bean arbitrary function. Then, 
there exists a unique multilinear function f: F” —» F such that f and f agree on {0,1}". 

Proof Sketch. For a complete proof, the reader is referred to |S Proposition 4.4]. Here, we 
note that the extension / can be explicitly written as 

n 

7( x )= f( b )Y[(( 1 - x i)( 1 ~ b i)+ x i b i)i ( 2 ) 

beto,!} 11 i-1 

where b = (bi, ■ ■ ■ , b n ) and x = ( x \, • • • , x n ) £ F”. ◄ 

For the lexicographically maximum satisfying assignment : {0,1}" —► {0,1} C F, let 
Vj>: F” —> F denote its multilinear extension. 

We request the oracles to grant local access to V$. Formally, we consider the following 
search problem: given a Boolean formula 4>, a prime |F|, and x £ F™, the task is to output the 
value V®(x). We regard this problem as a decision problem in the standard way. (Specifically, 
given the inputs specified above and auxiliary inputs k £ N and b £ {0,1}, the task is to 
output one bit saying whether or not the fcth bit of a binary representation of V$(x) is b.) 
The problem is still solvable in EXP np , by first computing in EXP np and then computing 
the expression ([2]) straightforwardly in exponential time. 

Therefore, the problem can be reduced to the original EXP NP -complete problem; by 
using the EXP NP -completeness, one can translate the problem of computing V$>(x) into the 
original problem in polynomial time, and hence we can ask the oracles to output V$(a;). Let 
fo, fi : F” — > F denote the answers of the oracles A 0l A 1 , respectively. Then, we have = F$ 
for an honest oracle A*. 

Although fi is not necessarily multilinear for a dishonest oracle A, ; , we can ensure 
that it is close to some multilinear function. This can be done by the multilinearity test, 
which was one of the main technical ingredients in the proof of MIP = NEXP [B]. For 
two functions f, a: F” —> F and a real number S £ R, we say that f and q are 5-close if 
Pr xev"[f(x) + g{x)\ < 8. 

► Lemma 4.6 (Multilinearity Test [6]). Let n £ N and F be a finite field. There exist a 
constant 8 = u°P^/|F| and an efficient probabilistic algorithm that, given oracle access to an 
arbitrary function f: F” —> F, 

1. accepts with probability 1 if f is multilinear, and 

2. rejects with high probability if f is not 8-close to any multilinear function. 

We perform the multilinearity test for f 0 and f±. Suppose that /,; is not 5-close to any 
multilinear function for a dishonest oracle A;. Then, the multilinearity test fails and hence 
we can doubt A with high probability. Therefore, in what follows, we may assume that both 
fo and fi are 5-close to some multilinear functions fo and /i, respectively (note that fo and 
/i are unique for small 5). 

In reality, we have only access to fo,fi instead of multilinear functions /o,/i- However, 
we may pretend to have access to the multilinear functions fo, fh by using the random 
self-reducibility of multivariate low-degree polynomials (also known as the self-correction of 
the Reed-Muller code). 
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► Lemma 4.7 (Self-correction; Beaver and Feigenbaum [8] and Upton [21]). There exists an 
efficient probabilistic algorithm that, given input x £ F" and oracle access to a function 
f: F" —► F that is 5-close to a multilinear function f: F" —► F, outputs f{x) with probability 
at least 1 — <5(n + 1). 

Proof. Let a o, • ’' , s n be arbitrary distinct points in F \ {0}. Pick a random point y F". 
By the polynomial interpolation, find the univariate polynomial p of degree at most n such 
that /(x + ai • y) = p(a*) for all i £ {0, • • • , n}, and output p(0). 

Since x + ai ■ y is uniformly distributed on F" for any fixed x and ai yf 0, it holds that 
f(x + ai ■ y) = f(x + ai ■ y) with probability at least 1 — <5. By the union bound, we have 
p{af) = f{x + a-j ■ y) for each j£ {0, • • • , n} with probability at least 1 — 5(n + 1); thus we 
have p(0 ) = /( x) with probability at least 1 — 5(n + 1), because / is a polynomial of total 
degree at most n. ◄ 

► Remark 4.8. In the case of the proof of MIP = NEXP, the self-correcting algorithm was 
not needed; for the sum-check protocol, it is sufficient to evaluate a multilinear function 
fi on random points x F™, rather than fixed points. In contrast, we need to evaluate 
a multilinear function fi on points that are not uniformly distributed, during the binary 
search. 

In the following, we pretend that the dishonest oracle Ai asserts that the satisfying 
assignment is /i|{o,i}»> instead of /j|{o,i} n - (Note that it holds that fy|{o,i}" = /-iI{o,l}"• = P<s 
for the honest oracle Ai.) 

Identifying the Larger Assignment 

We are now ready to describe how to identify the larger assignment. It is sufficient to show 
that we can find, with high probability, the lexicographically first index 2 £ {0,1}" such that 
fo(z)^fi(z). 

First, we check if /ofyin) = /lfyin): For each i £ {0,1}, run the self-correcting algorithm 
for fi to obtain fi(bi n ). If /ofyin) = /lfyin), then output it (which is surely the correct answer 
since /i(&m) = V$(&i n ) for the honest oracle A,) and halt. Otherwise, perform the binary 
search described below. 

We compute the lexicographically first disagreement 2 = (z i, • • • , z n ) £ {0, l} n one by 
one. For j := 1 to n, repeat the following: Suppose that we have computed z\, ■ ■ ■ , Zj-\. 
Pick a random point u = (u,j+ 1 ,--- ,u n ) £fl. F" - - 7 uniformly at random. Define x \= 
(zi, ■ ■ ■ , Zj-1 ,0, Uj + 1, ■ ■ • , u n ) £ F™. For each i £ {0,1}, use the self-correcting algorithm for 
fi to obtain ffx). If fo(x) fi(x), then set Zj := 0; else, set Zj := 1. 

► Claim 4.9. Assume that fo(b in ) ^ /i(6 in ). Let 2 £ {0,1}” denote the lexicographically first 
index such that fo(z) fy f\ (z). Then, the binary search described above correctly computes 
2 with probability at least 1 — 5n(n + 1) — ^j-. 

In particular, by setting |F| large enough, we can compute z with high probability. 

Proof. Let j £ {1, • • • ,n}. Consider the jth iteration and assume that we have computed 
zi, ■ ■ ■ , Zj -1 correctly. For each i £ {0,1}, let f [: F” -J —» F be the multilinear function such 
that 

fi (fj +1 > ' ' ‘ An) = fi(z 1, ' i Zj — 1,0, t j_|_i, ' ’ ' An)i 

for any (t )+1 , • • • , t n ) £ F" - - 7 . (The binary search tries to check if f' Q ^ /( by the polynomial 
identity testing, and sets Zj := 0 if and only if f 0 ^ /{•) 
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If zj = 0, then we have f' 0 ^ /{ because fo(z j+ i, ■ ■ ■ ,z n ) ^ f[(z j+1 ,--- ,z n ). The 
probability that the self-correcting algorithm outputs fi(x) correctly is at least 1 — S(n + 1) 
for a dishonest oracle Aj. By the Schwartz-Zippel lemma, the probability that ^ f[(u) 
for a random point u Gr F™ - - 5 is at least 1 — > 1 — Therefore, the algorithm sets 

Zj := 0 correctly with probability at least 1 — S(n + 1) — |fj-. 

If Zj = 1, then it follows from the minimality of 2 that /g(t) = f[(t) for every t G {0, l}" - - 5 . 
Since /g and /{ are multilinear, we have /g = f[ by the uniqueness of the multilinear extension 
(Proposition 4.51 and hence /g(it) = f[(u) holds for any u G F” _ L Therefore, since the 
self-correcting algorithm outputs fi(x) with probability at least 1 — S(n + 1), the algorithm 
sets Zj := 1 correctly with probability at least 1 — 6(n + 1). 

Overall, the algorithm computes z correctly with probability at least 


1 — S(n + 1 ) — 


m 


> 1 — Sn(n + 1 ) — 


|F|' 


We have computed the lexicographically first disagreement 2 G {0,1} such that fo(z) ^ 
fi(z). Run the self-correcting algorithm to obtain fo(z) and fi(z). Without loss of generality 
(by swapping the oracles if fo{z) > fi(z)), we may assume that fo(z) < fi(z). 

Now we know, with high probability, that A\ asserts the larger (presumably satisfying) 
assignment A | : {°> !}" F - 


Verifying the Satisfiability 

All that remains is to verify that /i|{o,i} n satisfies which can be done in the same way 
with a proof of MIP = NEXP. For completeness, we sketch a proof suggested in [BJ Section 
7.1] and observe that it can be done with the help of an EXP NP -complete oracle. 

Babai, Fortnow, Lund [B| used the sum-check protocol [22] to check whether or not an 
exponentially long assignment satisfies F$. Basically, checking if an assignment /i|{o. i}^ : 
{0,1}" —► F satisfies a Boolean formula reduces to checking if some low-degree polynomials 
g: F ; —► F evaluate to 0 on {0,1} Z . 

Let us arithmetize the Boolean formula 4>: {0, i} m + 3n + 3 _{0,1} to a low-degree 
polynomial <I>: F m+3 " +3 -* F in the standard way, so that $ and agree on {0, l} m + 3n + 3 
(see |6] Section 3.1]). Define g 1 : F m+3n —> F and g 2 : F” —>• F as 

g 1 {w) := 1 - 5 (w, /i(6i), /i(6 2 ), A(M) , (3) 

p 2 (b) := A(b) (l - /i(6)) , (4) 

where w = (y, (&i, 62, 63)) G F m x (F”) 3 and b G F". Note that since A an d ^ are low-degree 
polynomials, so are g 1 and g 2 . 

It is easy to see that g x {w) = 0 and g 2 (b) = 0 for any w G {0, l} m+3n and b G {0,1}" if 
and only if /lbgprn is a satisfying assignment of F$. Indeed, g 2 {b) = 0 forces /i|{o,i}" to 
be a Boolean function ( i.e. fi(b) G {0,1} for any b G {0,1}"), and g 1 (w) = 0 means that 
$( w > h{bi)Ji(b 2 )Ji{b 3 )) is true for any w G {0, l} m + 3n . 

We note that, given a random point w or 6, we can compute the value of g 1 (w) or g 2 (b) 
with high probability by substituting /1 for /1 in ^ or Q ( i.e. we do not need to use the 
self-correcting algorithm); for a random point w Gr F m+3ra , it holds that g 1 (w) computed by 
substituting /1 in |3| and 5 1 (w) are identical with probability at least 1 — 3 S. 
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Therefore, it is sufficient to show that we can check if each g £ {g 1 , g 2 } vanishes on {0,1} ; , 
given access to a low-degree polynomial g. (Here, l := m + 3n if g = g 1 and / := n if g = g 2 .) 
There are several ways to verify that g: —>• F vanishes on {0,1}*, including |B] Section 7.1] 
and mmm- Here, we follow the way of Feige, Goldwasser, Lovasz, Safra, and Szegedy m- 
We reduce a task of checking if g: F z —> F vanishes on {0,1}* to a task of checking if a 
sum is equal to 0, the latter of which can be verified by the sum-check protocol (see 113 
Section 4.2.2] for more details): Pick a random point t = (ti, • • • ,ti) £r F*. Consider the 
following sum: 

9{w) tl = 9(w) {wiU + l-Wi). (5) 

w=(wi ,••• {z|u>i = l} u>G{0,l} z £€{!.,••• , l } 

If g vanishes on {0,1} ; , then this sum is equal to 0. Otherwise, regarding the left-hand side of 
([5]) as a multilinear function on variables t±, ■ ■ ■ ,ti, the sum is not equal to 0 with probability 
at least 1 — by the Schwartz-Zippel lemma. Therefore, by defining a low-degree polynomial 
/it: F 1 -> F as h t (w) := g(w) n, e {i,.. n(witi + 1 — 1 Vi) for any w £ F ; , it is sufficient to 
check if the sum of ht(w) over w £ {0,1} ( is equal to 0, which can be done by the sum-check 
protocol. 

We describe the sum-check protocol briefly (see [6] Section 3.2] for a detailed description): 
In order to check if X)iue{o ip ht(w) = 0, pick a random point r = (r 1, • • • ,ri) £r¥ 1 . Define 
a low-degree univariate polynomial g ,: F —> F for each i £ {1, •••,/} as 

9 i{x) := ^2, ht(n,-■ ■ ,ri-i,x,w i+ i,-■ ■ ,wi) 

(w i+ jvnlelo.ip-* 

and go{x) := 0. We request the oracle A\ to reveal all the coefficients of the univariate 
polynomial gt for alH £ {1, ■ • • , /}. We trust Ai if and only if <7j_i(r,_i) = ffi(0) + <7i(l) for 
each i £ { 1, • • • , 1} (the Consistency Test) and <?z(n) = ht{r) (the Final Test). Here, since r 
is a random point, we may evaluate ht{r) by using /1 in place of f\ in ([3]) and Q. 

We claim that the complexity of the honest oracle to output gt is bounded by EXP np . 
Consider the following search problem: given a Boolean formula 4>, a prime |F|, and r, t £ F ; , 
the task is to output all the coefficients of gt for all i £ {1, • • ■ , 1} (which can be written 
in a binary representation of polynomial length), where is substituted for /1 in (J3]) and 
Q. Regarding this problem as a decision problem, one can easily show that the problem is 
computable in EXP np . Thus, we can request the oracle A\ to output gi. 

Finally, we conclude the proof by analyzing the correctness (assuming that the binary 
search succeeded): 

1. If A\ is honest, then f 1 = f 1 = V$. Thus, each g £ {g x ,g 2 } vanishes on {0,1} Z , and 
hence the sum ([5]) is 0; therefore, we can trust A\ with probability 1. 

2. If Hi is dishonest, then /1 does not constitute a satisfying assignment of F$. (If it 
were a satisfying assignment, then /lljop}" would be a satisfying assignment larger than 
/o|{o,i}" = Vb.) Thus, for some g £ {.g\g 2 }, the sum © is not 0 with probability at 
least 1 — Tjrr. 

Assume that the sum is not 0, and let d £ N be an upper bound on the degree of the 
low-degree polynomial h t . Suppose that the dishonest oracle claimed that gi is g[ for each 
i £ { 1, • • • ,/}. Assuming that the Consistency Tests pass ( i.e. 5(_ 1 (r,_ 1 ) = g[( 0) + g'( 1) 
for each i £ {1, • • • l}), it holds that g[{ri) ^ gi(n) = h t {r) with probability at least 1 — ^ 
(see [3 Section 3.2]). The probability that h t can be evaluated correctly on a random 
point r £r F ; is at least 1 — 3 S. Thus, the Final Test (i.e. g[(ri) = h t (r )) fails with 
probability at least 1 — — 3<5. 


S. Hirahara 


17 


Overall, we can doubt A\ with probability at least 1 



5 


Deterministic Selector 


This section is devoted to investigating a deterministic selector. 

To prove the existence of a deterministic selector for a PSPACE-complete language 
(Theorem 1.4 Part [l]), we show that a deterministic selector can be constructed based on 
downward self-reducibility: 


► Theorem 5.1. Any downward self-reducible language has a deterministic selector. 

Since there exists a downward self-reducible PSPACE-complete language, we immediately 
obtain a deterministic selector for any PSPACE-complete language. 


Proof. Let L be a downward self-reducible language. Namely, there exists a polynomial-time 
oracle machine M such that 
b M L (x) = L(x) for any x £ {0,1}*, and 

M does not make any queries of length greater than or equal to \x\, on input x £ {0,1}*. 

The idea is to keep a string y such that A 0 (y) ^ Ai(y ), and to run M A ° and M Al 
to obtain another string q of length less than \y\ such that A 0 (g) ^ Ai{q). Consider the 
following algorithm: Given an input x £ {0,1}* and two oracles A 0l Ai, if A 0 (x) = Ai{x) 
then output it and halt. Else, let y := x and repeat the following: Compute M Ai (y) for each 
i £ {0,1}. If M Aa {y) = M Al (y) =: b, then we trust the oracle A t such that Ai(y) = b and 
output Ai(x). Otherwise, let q be the first query that M A ° and M Al make on input y such 
that A 0 (g) ^ Ai(q). (There exists such a q because M A °(y) ^ M Al (y)\ moreover, it holds 
that |g| < \y\ by the definition of downward self-reducibility.) Then, we update y := q and 
move on to the next iteration. 

This algorithm runs in polynomial time, since \y\ decreases in each repetition. 

We claim the correctness of the algorithm. It is easy to see that A 0 (y) ^ A\(y) at the 
beginning of each repetition. Suppose that M A °(y) = M Al (y ) =: b. Since Aq or A\ is equal 
to L, we have b = M A °(y) = M Al (y ) = M L (y ) = L(y ), where the last equality holds by the 
definition of M. Moreover, there exists the unique i £ {0,1} such that Ai(y) = b because Aq 
and A\ disagree on y. Therefore, Ai is honest if and only if Ai(y) = b (= L(y )). ◄ 

Then, we claim that any language with a deterministic selector is in PSPACE (Theorem 


selector is PSPACE. 


1.4 Part pi). We thereby prove that the supremum of the languages with a deterministic 


Proof of Part [2] of Theorem 11.41 Let L be a language with a deterministic selector S. 

The idea is to regard a computation of S' as a game played between the NO player and the 
YES player (which correspond to two oracles A 0 and A\, respectively): On input x £ {0,1}*, 
the YES player tries to convince the selector S that x £ L, whereas the NO player tries to 
convince S that x qL L. The YES player chooses A\ C {0,1}* such that x £ Ai, and the NO 
player chooses A 0 C {0,1}* such that x qL A 0 . Then, we simulate S Ao,Al (a:), and the YES 
player wins if and only if S Ao,Al (x) = 1. 

It is easy to see that the YES player has a winning strategy if x £ L. Indeed, the YES 
player wins by setting A\ = L; similarly, if x fL L, then the NO player wins by setting Aq = L. 
Therefore, it is sufficient to show that we can compute the player that has a winning strategy 
in PSPACE. 
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We may restate the game as follows: Simulate S on input x. If S makes a query x to 
A, (i £ {0,1} ), then answer it with i. If S makes a query q (^ x ) to the oracle Aq, then 
the NO player gives an arbitrary answer; similarly, if S makes a query to A\, then the YES 
player gives an arbitrary answer. (However, we require the players to behave in a consistent 
way: if S makes the same query more than once, then a player must give the same answer 
that the player answered in the past.) 

Again, one can easily prove that the YES player has a winning strategy for this game if 
and only if x £ L. 

Now we describe a polynomial-time alternating Turing machine that computes L: Simulate 
the game described above, while universally guessing the answers of the NO player and 
existentially guessing the answers of the YES player. Since a polynomial-time alternating 
machine can be simulated in PSPACE, it holds that L £ PSPACE. ◄ 


Random Strings vs. Randomized Computation 

In this section, we apply the notion of selector to the proof by Buhrman, Fortnow, Koucky, 
and Loff [Til . We thereby extend their result from { NP, P# p , PSPACE, EXP } to any classes 
whose complete languages have a selector ( e.g. X p ,n p ,P# p ,PSPACE,EXP, and EXP np ). 

► Theorem 6.1 (Extended Theorem 15 of [TT]). Let a: {0}* —>• {0,1}* be a length preserving 
function, c > 0 be a constant such that a(0") ^ i.o-EXP/n — clogn, and C be a complexity 
class such that there is a selector for some paddable C-complete language L. If L £ P/a(0” ) 
for some d > 0, then C C BPP. 

Proof. Let M be a polynomial-time machine such that L(x) = M (x, a(0l x l d )^, and G n C 
{0, l}" d be the set of “good” advice: 

G n := {r £ {0,1}”" | Vx € {0,1}", L(x) = M(x, r ) }. 

Buhrman et al. mi showed that \G n \ > 2 n /n cd by exploiting the high nonuniform complexity 
of advice a(0 n<i ). 

As with Theorem |2.8[ there exist a polynomial l and a selector S that identifies an honest 
oracle among to := 2 l(n) cd oracles with probability at least |, and makes only queries of 
length exactly l{n) on inputs of length n. 

Consider the following probabilistic algorithm: On input x £ {0, l} n , let l denote l(n). 
We pick m random strings rq, • • • , r m £r {0, ly uniformly at random, and define oracles 
A,(q) = M(q, rf), for any i £ {1, • ■ • , to} and for any q £ {0,1} ; . We simulate S on input x, 
answering its queries q £ {0,1} Z to Aj by computing M(q,rf). 

The probability that we fail to pick any “good” advice, namely r \ qL Gi for all z, is 
(1 — |G/|) < e~ M < g. Thus, we can output the correct answer with probability at 

least | overall. ◄ 

7 Concluding Remarks 

We state some open problems and possible directions for future work: 
h Do there exist selectors for NEXP-complete languages or promise-S^-complete languages? 
In particular, it is interesting to close the gap between EXP np and S™ 15 : although these 
classes seem “close” in some sense, EXP np and are very different in the known 
relationship with BPP; it is a notorious open problem whether BPP ^ EXP np , whereas 
one can prove BPP ^ 


6 
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h We proved that a property of removing short advice can be captured by the notion of 
selector. What about a property of removing advice of polynomial length? 
h The result of MIP = NEXP was “scaled-down” to obtain the relationship with hardness 
of approximating cliques E3> and eventually the PCP theorem mm was established. 
Can we obtain such interesting applications of selectors, by scaling down the selector for 
EXP NP -complete languages? 
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